python查找每天每个ip的攻击次数

Question

嘿，我试图发现每天每个ip都记录了许多攻击。我正在读取syslog文件。在

这里有一行几行在读

引用。。。在

Jan 10 09:32:09 j4-be03 sshd[3876]: Failed password for root from 218.241.173.35 port 47084 ssh2
Jan 10 09:32:19 j4-be03 sshd[3879]: Failed password for root from 218.241.173.35 port 47901 ssh2
Feb 7 17:19:16 j4-be03 sshd[10736]: Failed password for root from 89.249.209.92 port 46139 ssh2 

这是我的代码：

^{pr2}$

目前给出的结果是错误的：

引用。。。在

Feb 8 has 33 attacks
218.241.173.35 has 15 attacks
72.153.93.203 has 14 attacks
213.251.192.26 has 13 attacks
66.30.90.148 has 14 attacks
Feb 7 has 15 attacks
92.152.92.123 has 5 attacks
Jan 10 has 28 attacks
89.249.209.92 has 15 attacks 

哪些ip地址是错误的，不知道哪里出了问题，希望有人能帮忙

Answer 1

试试这个解决方案，我用问题中的示例输入进行了测试，效果很好：

import re
from collections import defaultdict
pattern = re.compile(r'(\w{3}\s+\d{1,2}).+Failed password for .+? from (\S+)')

def attack_dict(myfile):
    attacks = defaultdict(lambda: defaultdict(int))
    for line in myfile:
        found = pattern.match(line)
        if found:
            date, ip = found.groups()
            attacks[date][ip] += 1
    return attacks

def report(myfile):
    for date, ips in attack_dict(myfile).iteritems():
        print '{0} has {1} attacks'.format(date, sum(ips.itervalues()))
        for ip, n in ips.iteritems():
            print '\t{0} has {1} attacks'.format(ip, n)

这样运行：

^{pr2}$